Crumpled Thoughts

I’ve used a lot of different broadband Internet service since 2000. In 2000 I got DSL from Micron.net at an apartment. I got Qwest DSL in 2000 when I bought my house. Switched to cable in 2004 when it became available at my house. Switched back to Qwest DSL in 2008. I’ve also supported Clearwire wireless, Satellite ISPs, and data T1s from numerous providers for local businesses.

Qwest DSL is the best option right now for a residential ISP, for the following reasons:

Price: 

If you can get Qwest’s fiber service, you can get 12M down, 896k up for $55/month. Qwest offers 7M down, 896k up for $38/month. CableOne charges $49 for 5M down, 500K up, or $59/month for 10M down, 1M up. I know it doesn’t seem like a big difference on the higher plans, but what CableOne doesn’t make obvious is how they throttle bandwidth. It’s the thing that made me move back to Qwest. After you download a couple of gigabytes in a day, CableOne will drop your speed significantly. It will stay slow until midnight, then go back up. Say a new Linux distro comes out that you want to download, and you’re on the 5M plan. After you download 3GB CableOne will drop you from 5M download to about 1.5M. Keep downloading, it keeps falling. At Midnight it goes back up. Even on the 10M plan, they drop your speed after downloading 5GB. At 10M you can download 5GB in about an hour. Say hello to slow until midnight. With Qwest, you get your 1.5M, 7M, 12M, or 20M all day, every day as long as you have service. I’ve downloaded over 40GB in a day and not slowed down.

Uptime:

In the past 10 months of having Qwest fiber 12M service, I have had zero downtime. DSL is typically more stable than cable. With CableOne at least every 2—3 months I would have an outage. I have actually had better uptime with my DSL than we have had with our 3 data T1s at the office (thunderstorm took out a repeater and we had 2 circuits go down). Cable is more finicky.

Network tampering/management:

CableOne tampers with your internet access. They won’t let you connect to TCP port 25 on any mail server but theirs. If they think your bandwidth is being used for BitTorrents, or newsgroups they will restrict your speed. They decide what traffic gets priority. Qwest doesn’t do that. If you pay for your service, they’ll provide it. I think CableOne has a right to do that, it is in their Terms of Service. I, as a customer, have a right to think it sucks and go to another provider.

Acceptable Use:

If someone complains to CableOne about how you’re using the Internet, they will shut you off before asking you about it. It can take from several hours, to several days to get service back. I had just travelled to Portland to set up a remote office for a client when CableOne shut off my Internet connection at home. Someone had hacked a Linux box on my home network and was using it for bad things. I called from my hotel in Portland, but couldn’t do anything about it because they shut the connection down. I was going to be there for 3 days before returning home. It really pissed me off. If they had at least emailed me before shutting down the connection I could have remotely powered down the box and still had internet at the house. Their policy of terminate first, ask questions later bothers me.

I’ve been very happy with Qwest DSL since switching back. It is the only Qwest service I use, even though my girlfriend works there. I run Asterisk at home for phone service and pay $1.50/month plus 1 penny per minute for my calls. It’s usually about $4 per month.

That is my opinion. Feel free to leave a comment if you think I’m wrong

Today I had to set up a Treo 650 to access a user’s Exchange mailbox over the web. I did not imagine it would be as difficult as it turned out to be.

At this site we run a Linux router/firewall that handles all traffic coming into, and leaving the network. We use Apache’s mod_proxy to proxy web connections from the internet to IIS servers on the private network. Having had more than a couple 36+ hour days cleaning up viruses due to exploited IIS servers, I feel much more comfortable having Apache handle the web requests.

One of the “Gotcha’s” to using mod_proxy is that you have to disable “Integrated Windows Authentication” on any sites you proxy with Apache. Apache doesn’t understand the headers involved. No big deal, because these requests are typically coming from the internet over SSL.

I started the setup at about 12:00 noon today. The first thing I did was add the following bits of code to the Apache configuration file to Proxy the ActiveSync connections:

#ActiveSync
ProxyPass /Microsoft-Server-ActiveSync https://webmail.example.com/Microsoft-Server-ActiveSync
ProxyPassReverse /Microsoft-Server-ActiveSync https://webmail.example.com/Microsoft-Server-ActiveSync

I then put the appropriate settings into the Treo, and tested connectivity. This is where things started to piss me off.

The software on the Treo has terrible, non-intuitive error codes. The documentation is even worse. This is what I discovered (over about 4 hours of trying to get it to work):

• For the ProxyPass directives to work, you can not use Integrated Windows Authentication on the IIS site.
• For the Treo VersaMail app to use Exchange ActiveSync it must use kerberos authentication, which requires enabling Integrated Windows Authentication.
• Palm’s software engineers don’t really give a shit whether the error message you get is in any way helpful, just as long as you understand it’s not working.

So the thing that sucks about this is that we run “stuff” on the gateway which requires us to use Apache on Linux. It provides remote access for employees through a web interface, and dynamically modifies iptables firewall rules when folks need access.

This was my fix, which I think is as good of a fix as is possible.

• Exported the IIS web site that handled OWA, OMA, and ActiveSync to a file.
• Created a new web site from the exported file.
• Changed the TCP ports for HTTP and HTTPS to obscure, high ports.
• Modified the document root on the IIS site, as all the magic happens in Virtual Directories.
• Requested/Installed a new SSL certificate from an internal enterprise CA with a common name matching the internet FQDN.
• Enabled “Integrated Windows Authentication” on the “Exchange” virtual directory in this new web site.
• Forwarded the obscure, high SSL port from the firewall into the Exchange server.

Now the Treo works… just had to set the obscure high port in the advanced settings on the Treo. I didn’t want to go down the forwarded port road, because it seems like a compromise in security. All too often I see people bypass security measures in order to get things to work, and I hate it. This seems like a small compromise I’ll have to settle for.

Got a better solution? Let me know.

-Chris